Unverified Commit ce3af784 authored by Ramses's avatar Ramses Committed by GitHub
Browse files

[Backport release-25.05] nixos/specialisation: escape and restrict specialisation names (#408069)

parents 4a4ef96b 1b2b3e1e

nixos/modules/system/activation/specialisation.nix

+11 −1
Original line number Diff line number Diff line
@@ -10,6 +10,8 @@ 
let

  inherit (lib)

    concatStringsSep

    escapeShellArg

    hasInfix

    mapAttrs

    mapAttrsToList

    mkOption
@@ -84,10 +86,18 @@ in 
  };



  config = {

    assertions = mapAttrsToList (name: _: {

      assertion = !hasInfix "/" name;

      message = ''

        Specialisation names must not contain forward slashes.

        Invalid specialisation name: ${name}

      '';

    }) config.specialisation;



    system.systemBuilderCommands = ''

      mkdir $out/specialisation

      ${concatStringsSep "\n" (

        mapAttrsToList (name: path: "ln -s ${path} $out/specialisation/${name}") children

        mapAttrsToList (name: path: "ln -s ${path} $out/specialisation/${escapeShellArg name}") children

      )}

    '';

  };